Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Shared environments with developers who run Composer individually on the same project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the patched versions are applied at the earliest convenience. Where not possible, the following should be addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and avoid running Composer within an untrusted directory, or if needed, verify that the contents of `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code. A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ```

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7603-1 advisory.

    Thomas Chauchefoin discovered that Composer did not correctly handle certain arguments. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24828, CVE-2023-43655)

    Ed Cradock discovered that Composer did not correctly handle the exclusion of certain files. An attacker     could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.
    (CVE-2024-24821)

    Martin Haunschmid discovered that Composer did not correctly handle git branch names. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2024-35241)

    Maciej Piechota discovered that Composer did not correctly handle VCS branch names. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2024-35242)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-539 advisory.

    Composer is a dependency Manager for the PHP language. In affected versions several files within the local     working directory are included during the invocation of Composer and in the context of the executing user.
    As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide     lateral user movement or malicious code execution when Composer is invoked within a directory with     tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The     following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer     on untrusted projects, Shared environments with developers who run Composer individually on the same     project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the     patched versions are applied at the earliest convenience. Where not possible, the following should be     addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and     avoid running Composer within an untrusted directory, or if needed, verify that the contents of     `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
    A reset can also be done on these files by the following:```shrm vendor/composer/installed.php     vendor/composer/InstalledVersions.phpcomposer install --no-scripts --no-plugins``` (CVE-2024-24821)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0592-1 advisory.

  - Composer is a dependency Manager for the PHP language. In affected versions several files within the local     working directory are included during the invocation of Composer and in the context of the executing user.
    As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide     lateral user movement or malicious code execution when Composer is invoked within a directory with     tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The     following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer     on untrusted projects, Shared environments with developers who run Composer individually on the same     project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the     patched versions are applied at the earliest convenience. Where not possible, the following should be     addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and     avoid running Composer within an untrusted directory, or if needed, verify that the contents of     `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
    A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php     vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ``` (CVE-2024-24821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 33ba2241-c68e-11ee-9ef3-001999f8d30b advisory.

  - Composer is a dependency Manager for the PHP language. In affected versions several files within the local     working directory are included during the invocation of Composer and in the context of the executing user.
    As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide     lateral user movement or malicious code execution when Composer is invoked within a directory with     tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The     following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer     on untrusted projects, Shared environments with developers who run Composer individually on the same     project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the     patched versions are applied at the earliest convenience. Where not possible, the following should be     addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and     avoid running Composer within an untrusted directory, or if needed, verify that the contents of     `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
    A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php     vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ``` (CVE-2024-24821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241064	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Composer vulnerabilities (USN-7603-1)	Nessus	Ubuntu Local Security Checks	high
191593	Amazon Linux 2023 : composer (ALAS2023-2024-539)	Nessus	Amazon Linux Local Security Checks	high
190923	SUSE SLES15 / openSUSE 15 Security Update : php-composer2 (SUSE-SU-2024:0592-1)	Nessus	SuSE Local Security Checks	high
190374	FreeBSD : Composer -- Code execution and possible privilege escalation (33ba2241-c68e-11ee-9ef3-001999f8d30b)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-24821

high

Tenable Plugins

high

high

high

high